Advisory Details

August 14th, 2018

Crestron Multiple Products CTP Console Privilege Escalation Vulnerability

CVE ID	CVE-2018-13341
CVSS SCORE	8.5, AV:N/AC:M/Au:S/C:C/I:C/A:C
AFFECTED VENDORS	Crestron
AFFECTED PRODUCTS	TSW-760
VULNERABILITY DETAILS	This vulnerability allows remote attackers to escalate privileges on affected installations of all Crestron products. Authentication is required to exploit this vulnerability. The specific flaw exists within the two built-in accounts on all Crestron devices. An attacker can leverage this vulnerability to execute arbitrary code under the context of Administrator.
ADDITIONAL DETAILS	Crestron has issued an update to correct this vulnerability. More details can be found at: https://ics-cert.us-cert.gov/advisories/ICSA-18-221-01
DISCLOSURE TIMELINE	2018-05-08 - Vulnerability reported to vendor 2018-08-14 - Coordinated public release of advisory 2018-08-14 - Advisory Updated
CREDIT	Ricky "HeadlessZeke" Lawshae

BACK TO ADVISORIES